{"id":2448,"date":"2017-01-25T14:38:35","date_gmt":"2017-01-25T14:38:35","guid":{"rendered":"https:\/\/staging.elixirrdigital.com\/us\/2017\/01\/25\/general-data-protection-regulation-mean-digital-marketers\/"},"modified":"2025-03-05T15:52:37","modified_gmt":"2025-03-05T15:52:37","slug":"general-data-protection-regulation-mean-digital-marketers","status":"publish","type":"post","link":"https:\/\/staging.elixirrdigital.com\/us\/2017\/01\/25\/general-data-protection-regulation-mean-digital-marketers\/","title":{"rendered":"General Data Protection Regulation &#8211; What Does It Mean For Digital Marketers?"},"content":{"rendered":"<p><strong>Disclaimer &#8211; I\u2019m not a lawyer, so this is not legal advice.<\/strong> I\u2019ve chewed through the regulations and I have gained a fairly clear idea of what the changes are, and am highlighting them below. I\u2019m also focussing on what this means for marketers \u2013 but these regulations reach far and wide, to any personal data.<\/p>\n<h2>What Is The GDPR?<\/h2>\n<p>New legislation from the EU to help protect its citizens and their personal data. It comes into effect in 2018. These new rules protect EU citizens globally. Even companies based outside of the EU will have to abide by these rules when dealing with personal data from EU citizens.<\/p>\n<p><center><img decoding=\"async\" class=\"aligncenter size-full wp-image-6750\" src=\"https:\/\/staging.elixirrdigital.com\/us\/wp-content\/uploads\/2025\/03\/GDPR.png\" alt=\"\"><\/center><\/p>\n<h2>Personal Data<\/h2>\n<p>Personal data essentially means any data that you can use to personally identify an individual \u2013 like a name, email address or phone number. Data that is anonymous, like website performance tracking data, is not covered.<\/p>\n<h2>Data Controllers &amp; Data Processors<\/h2>\n<p>A Data Controller is someone that owns personal data (of any kind). For example, your customer data would be classified as personal data.<\/p>\n<p>A Data Processor is someone that processes personal data that belongs to someone else. For example, your <a href=\"https:\/\/staging.elixirrdigital.com\/us\/services\/email-marketing\/\">email marketing<\/a> platform would be a Data Processor as they use and \u2018process\u2019 personal data, but do not own the data.<\/p>\n<h2>The Big Changes<\/h2>\n<h3>Responsibility for data<\/h3>\n<p>Currently Data Controllers are responsible for the safe keeping on their data. However, these new rules extend more responsibility to Data Processors. This includes agencies like us, as well as any mail platforms, external CRM systems \u2013 anywhere your customer data could be \u2018processed\u2019.<\/p>\n<h3>Consent \u2013 Users Have To Opt-in<\/h3>\n<p>I know what you\u2019re thinking \u2013 we already have to do that. True, but the rules on consent are changing. The majority of the changes are focussed on record keeping (by both the Data Controller and Processors involved).<\/p>\n<blockquote><p>&#8220;To be valid, consent must be knowingly and freely given, clear and specific. Organisations should keep clear records of what an individual has consented to, and when and how this consent was obtained, so that they can demonstrate compliance in the event of a complaint.&#8221;<\/p><\/blockquote>\n<ul>\n<li>Freely given \u2013 users have to have taken a positive action to opt in. A pre-ticked box is not covered.<\/li>\n<li>Specific \u2013 a user has to be able to specifically opt-in to receive communications in various forms. If you use email and telemarketing, the user will need to be able to opt-in to both, either or none of these forms of marketing separately.<\/li>\n<li>Informed \u2013 Users now need to be explicitly reminded of the rights that these regulations provide. Privacy Policies will need to be updated to ensure this is covered.<\/li>\n<\/ul>\n<p>This does apply retrospectively too \u2013 if your current consent does not abide by the new regulations, then you will need to consider how you can bring it up to date.<\/p>\n<p><center><img decoding=\"async\" class=\"aligncenter size-full wp-image-6754\" src=\"https:\/\/staging.elixirrdigital.com\/us\/wp-content\/uploads\/2025\/03\/email-marketing.gif\" alt=\"\"><\/center><\/p>\n<h3>Buying Data And Third Party Consent<\/h3>\n<p>Buying or leasing data is currently a well-used practice in particular with B2B marketing, however these changes also affect third party consent.<\/p>\n<blockquote><p>\u201cIn most circumstances, indirect consent would not [be sufficient] \u2013 as the customer did not directly notify the sender, they notified someone else. Therefore it is best practice for an organisation to only send marketing texts and emails, or make automated calls to individuals, if it obtained consent directly from that person\u201d<\/p><\/blockquote>\n<p>When buying data (in most cases) you\u2019ll have to be able to show that you gained consent directly from the users \u2013 the guidelines suggest you should aim to do this within a reasonable period (one month) or at least inline with the first communication.<\/p>\n<p>But surely if the user has opted in to have their data passed to third parties we don\u2019t need to gain consent again? This is currently true, however the new regulations tighten up on how third party consent can be gained.<\/p>\n<p>As an example \u2013 here\u2019s a privacy policy that could currently be used to opt-in to pass data to a third party:<\/p>\n<p><i style=\"font-style: italic;\">\u201cWe may use the personal information that you supply to us and work with other third party businesses to bring selected retail opportunities to you via direct mail, email and telemarketing. These businesses may include providers of direct marketing services and applications, including lookup and reference, data enhancement, suppression and validation and email marketing.\u201d<\/i><\/p>\n<p>With the new rules this would not be specific enough. It\u2019s not clear enough as to what these business actually are, or what they do and the business types listed are likely to be meaningless to most people.<\/p>\n<h3>Consent Is Not Forever<\/h3>\n<p>Another change relevant to consent is that consent will expire over time. Although there are no defined limits, context has to be arguable for consent to remain valid. For example, lets say I subscribe to a magazine and opt-in to receive marketing communications from them. After 12 months, I don\u2019t renew my subscription \u2013 is my initial consent (now 12 months old) still valid? Arguably no, as I\u2019ve unsubscribed from the magazine. It\u2019s likely that new consent would need to be gained.<\/p>\n<h3>Record Keeping And Reminding<\/h3>\n<p>As well as all these changes, more detailed records will need to be kept. Data Controllers are obliged to keep records of when and where a user gave consent and what they gave consent for. If a user asks, you have to provide it. It\u2019s also the obligation of the Data Controller to remind opted-in users of their rights, and what data is stored on them. Records should also be kept of when users were last reminded.<\/p>\n<h3>Data Breaches<\/h3>\n<p>As well as all the above, there are some changes to how breaches need to be reported. This is a follow up to some high profile breaches in recent times, and again is designed to protect the citizens.<\/p>\n<p>TalkTalk for example, had a large data breach and fulfilled their current obligations by reporting the breach to the regulator within 72 hours. However it wasn\u2019t until months later that customers were informed. In this time, the customer\u2019s details were available online, and fraudsters were able to take advantage of this.<\/p>\n<p><center><img decoding=\"async\" class=\"aligncenter size-full wp-image-6758\" src=\"https:\/\/staging.elixirrdigital.com\/us\/wp-content\/uploads\/2025\/03\/data-breaches.jpeg\" alt=\"\"><\/center>The new rules impose bigger fines, but also will mean breaches have to be reported to both regulators and customers within a short window.<\/p>\n<p>It\u2019s also worth noting that if the data that\u2019s lost is encrypted, then it\u2019s not classified as a data breach.<\/p>\n<h2>In Summary<\/h2>\n<p><strong>TL;DR<\/strong> \u2013 Big changes are coming. As marketers we need to make sure that:<\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>we have specific detailed consent for all of the personal data we use<\/li>\n<li>users are made aware of how their data is used<\/li>\n<li>we keep detailed records on how this was all done and when the user was last reminded of their rights<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>The first step is likely to be auditing any data that you do own, and how it moves around the business, or between Data Processors. You\u2019ll need to understand what data is where, what consent is associated with it, as well as who is processing it, so that you can comply with any potential requests from users or authorities.<\/p>\n<p>The Information commission have all the gory details if you\u2019d like to find out more:<br \/>\n<a href=\"https:\/\/ico.org.uk\/for-organisations\/guide-to-data-protection\/\" target=\"_blank\" rel=\"noopener\">https:\/\/ico.org.uk\/for-organisations\/guide-to-data-protection\/<\/a><br \/>\n<a href=\"https:\/\/ico.org.uk\/for-organisations\/data-protection-reform\/overview-of-the-gdpr\/\" target=\"_blank\" rel=\"noopener\">https:\/\/ico.org.uk\/for-organisations\/data-protection-reform\/overview-of-the-gdpr\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Disclaimer &#8211; I\u2019m not a lawyer, so this is not legal advice. I\u2019ve chewed through the regulations and I have gained a fairly clear idea of what the changes are,&hellip;<\/p>\n","protected":false},"author":11,"featured_media":2449,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"related_service":[71],"related_industry":[],"class_list":["post-2448","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"acf":[],"card":"<article class=\"wp-component-card wp-component-card--dark wp-component-card--resource wp-component-card--post wp-component-card--full-width            wp-component-card--link js-card-link\n        \">\n            <div class=\"wp-component-card__image\">\n            <img width=\"868\" height=\"579\" src=\"https:\/\/staging.elixirrdigital.com\/us\/wp-content\/uploads\/sites\/2\/2025\/03\/eu-gdpr-868x579.jpeg\" class=\"attachment-card-1-col size-card-1-col\" alt=\"\" decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/staging.elixirrdigital.com\/us\/wp-content\/uploads\/sites\/2\/2025\/03\/eu-gdpr-868x579.jpeg 868w, https:\/\/staging.elixirrdigital.com\/us\/wp-content\/uploads\/sites\/2\/2025\/03\/eu-gdpr-276x184.jpeg 276w, https:\/\/staging.elixirrdigital.com\/us\/wp-content\/uploads\/sites\/2\/2025\/03\/eu-gdpr-696x464.jpeg 696w, https:\/\/staging.elixirrdigital.com\/us\/wp-content\/uploads\/sites\/2\/2025\/03\/eu-gdpr-450x300.jpeg 450w\" sizes=\"auto, (max-width: 868px) 100vw, 868px\" \/>        <\/div>\n        <div class=\"wp-component-card__content\">\n        <div class=\"wp-component-card__content-top\">\n                                                    <p class=\"wp-component-card__eyebrow\">\n                    Blog                <\/p>\n                        <a href='https:\/\/staging.elixirrdigital.com\/us\/2017\/01\/25\/general-data-protection-regulation-mean-digital-marketers\/'>\n        <h2 class='wp-component-card__title'>\n            General Data Protection Regulation &#8211; What Does It Mean For Digital Marketers?\n        <\/h2>\n    <\/a>        <\/div>\n                    <div class=\"wp-component-card__content-bottom\">\n                                    <div class=\"wp-component-card__description wysiwyg\">\n                        Disclaimer &#8211; I\u2019m not a lawyer, so this is not legal advice. I\u2019ve chewed through the regulations and I have gained a fairly clear idea of what the changes are,&hellip;                    <\/div>\n                                                                    <div class=\"wp-component-card__meta\">\n                                                    <p class=\"wp-component-card__date\">\n                                25 January 2017                            <\/p>\n                                                                            <div class=\"wp-component-card__terms\">\n                                                                                            <div class=\"wp-component-tags__tag\">\n                Privacy            <\/div>\n                                                                                                            <\/div>\n                                            <\/div>\n                                            <\/div>\n            <\/div>\n<\/article>\n","_links":{"self":[{"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/posts\/2448","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/comments?post=2448"}],"version-history":[{"count":0,"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/posts\/2448\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/media\/2449"}],"wp:attachment":[{"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/media?parent=2448"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/categories?post=2448"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/tags?post=2448"},{"taxonomy":"related_service","embeddable":true,"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/related_service?post=2448"},{"taxonomy":"related_industry","embeddable":true,"href":"https:\/\/staging.elixirrdigital.com\/us\/wp-json\/wp\/v2\/related_industry?post=2448"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}